From: Ira Weiny <ira.weiny@intel.com>
To: Dan Williams <dan.j.williams@intel.com>, <nvdimm@lists.linux.dev>
Cc: Yongqiang Liu <liuyongqiang13@huawei.com>,
Paul Cassella <cassella@hpe.com>, Ira Weiny <ira.weiny@intel.com>,
<linux-cxl@vger.kernel.org>
Subject: Re: [PATCH 3/4] dax: Introduce alloc_dev_dax_id()
Date: Sat, 3 Jun 2023 19:57:02 -0700 [thread overview]
Message-ID: <647bfd7e1ef3_4c9842941c@iweiny-mobl.notmuch> (raw)
In-Reply-To: <168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com>
Dan Williams wrote:
> The reference counting of dax_region objects is needlessly complicated,
> has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up
> that mess introduce alloc_dev_dax_id() to minimize the holding of a
> dax_region reference to only what dev_dax_release() needs, the
> dax_region->ida.
>
> Part of the reason for the mess was the design to dereference a
> dax_region in all cases in free_dev_dax_id() even if the id was
> statically assigned by the upper level dax_region driver. Remove the
> need to call "is_static(dax_region)" by tracking whether the id is
> dynamic directly in the dev_dax instance itself.
>
> With that flag the dax_region pinning and release per dev_dax instance
> can move to alloc_dev_dax_id() and free_dev_dax_id() respectively.
>
> A follow-on cleanup address the unnecessary references in the dax_region
> setup and drivers.
>
> Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices")
> Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1]
> Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2]
> Reported-by: Yongqiang Liu <liuyongqiang13@huawei.com>
> Reported-by: Paul Cassella <cassella@hpe.com>
> Reported-by: Ira Weiny <ira.weiny@intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
> drivers/dax/bus.c | 56 +++++++++++++++++++++++++++------------------
> drivers/dax/dax-private.h | 4 ++-
> 2 files changed, 37 insertions(+), 23 deletions(-)
>
> diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
> index c99ea08aafc3..a4cc3eca774f 100644
> --- a/drivers/dax/bus.c
> +++ b/drivers/dax/bus.c
> @@ -446,18 +446,34 @@ static void unregister_dev_dax(void *dev)
> put_device(dev);
> }
>
> +static void dax_region_free(struct kref *kref)
> +{
> + struct dax_region *dax_region;
> +
> + dax_region = container_of(kref, struct dax_region, kref);
> + kfree(dax_region);
> +}
> +
> +void dax_region_put(struct dax_region *dax_region)
> +{
> + kref_put(&dax_region->kref, dax_region_free);
> +}
> +EXPORT_SYMBOL_GPL(dax_region_put);
> +
> /* a return value >= 0 indicates this invocation invalidated the id */
> static int __free_dev_dax_id(struct dev_dax *dev_dax)
> {
> - struct dax_region *dax_region = dev_dax->region;
> struct device *dev = &dev_dax->dev;
> + struct dax_region *dax_region;
> int rc = dev_dax->id;
>
> device_lock_assert(dev);
>
> - if (is_static(dax_region) || dev_dax->id < 0)
> + if (!dev_dax->dyn_id || dev_dax->id < 0)
> return -1;
> + dax_region = dev_dax->region;
> ida_free(&dax_region->ida, dev_dax->id);
> + dax_region_put(dax_region);
> dev_dax->id = -1;
> return rc;
> }
> @@ -473,6 +489,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax)
> return rc;
> }
>
> +static int alloc_dev_dax_id(struct dev_dax *dev_dax)
> +{
> + struct dax_region *dax_region = dev_dax->region;
> + int id;
> +
> + id = ida_alloc(&dax_region->ida, GFP_KERNEL);
> + if (id < 0)
> + return id;
> + kref_get(&dax_region->kref);
> + dev_dax->dyn_id = true;
> + dev_dax->id = id;
> + return id;
> +}
> +
> static ssize_t delete_store(struct device *dev, struct device_attribute *attr,
> const char *buf, size_t len)
> {
> @@ -560,20 +590,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = {
> NULL,
> };
>
> -static void dax_region_free(struct kref *kref)
> -{
> - struct dax_region *dax_region;
> -
> - dax_region = container_of(kref, struct dax_region, kref);
> - kfree(dax_region);
> -}
> -
> -void dax_region_put(struct dax_region *dax_region)
> -{
> - kref_put(&dax_region->kref, dax_region_free);
> -}
> -EXPORT_SYMBOL_GPL(dax_region_put);
> -
> static void dax_region_unregister(void *region)
> {
> struct dax_region *dax_region = region;
> @@ -1297,12 +1313,10 @@ static const struct attribute_group *dax_attribute_groups[] = {
> static void dev_dax_release(struct device *dev)
> {
> struct dev_dax *dev_dax = to_dev_dax(dev);
> - struct dax_region *dax_region = dev_dax->region;
> struct dax_device *dax_dev = dev_dax->dax_dev;
>
> put_dax(dax_dev);
> free_dev_dax_id(dev_dax);
> - dax_region_put(dax_region);
> kfree(dev_dax->pgmap);
> kfree(dev_dax);
> }
> @@ -1326,6 +1340,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
> if (!dev_dax)
> return ERR_PTR(-ENOMEM);
>
> + dev_dax->region = dax_region;
Overall I like that this reference is not needed to be carried and/or
managed by the callers.
However, here you are referencing the dax_region from the dev_dax in an
unrelated place to where the reference matters (in id management).
Could alloc_dev_dax_id() change to:
static int alloc_dev_dax_id(struct dev_dax *dev_dax, struct dax_region *dax_region)
{
...
}
Then make this assignment next to where the kref is taken so it is clear
that this is the only user of the reference?
I did not pick up on the fact this reference was only needed to free the
id at all in reviewing the code and I think this would make it even more
clear.
Ira
> if (is_static(dax_region)) {
> if (dev_WARN_ONCE(parent, data->id < 0,
> "dynamic id specified to static region\n")) {
> @@ -1341,13 +1356,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
> goto err_id;
> }
>
> - rc = ida_alloc(&dax_region->ida, GFP_KERNEL);
> + rc = alloc_dev_dax_id(dev_dax);
> if (rc < 0)
> goto err_id;
> - dev_dax->id = rc;
> }
>
> - dev_dax->region = dax_region;
> dev = &dev_dax->dev;
> device_initialize(dev);
> dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id);
> @@ -1388,7 +1401,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data)
> dev_dax->target_node = dax_region->target_node;
> dev_dax->align = dax_region->align;
> ida_init(&dev_dax->ida);
> - kref_get(&dax_region->kref);
>
> inode = dax_inode(dax_dev);
> dev->devt = inode->i_rdev;
> diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
> index 1c974b7caae6..afcada6fd2ed 100644
> --- a/drivers/dax/dax-private.h
> +++ b/drivers/dax/dax-private.h
> @@ -52,7 +52,8 @@ struct dax_mapping {
> * @region - parent region
> * @dax_dev - core dax functionality
> * @target_node: effective numa node if dev_dax memory range is onlined
> - * @id: ida allocated id
> + * @dyn_id: is this a dynamic or statically created instance
> + * @id: ida allocated id when the dax_region is not static
> * @ida: mapping id allocator
> * @dev - device core
> * @pgmap - pgmap for memmap setup / lifetime (driver owned)
> @@ -64,6 +65,7 @@ struct dev_dax {
> struct dax_device *dax_dev;
> unsigned int align;
> int target_node;
> + bool dyn_id;
> int id;
> struct ida ida;
> struct device dev;
>
next prev parent reply other threads:[~2023-06-04 2:57 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-03 6:13 [PATCH 0/4] dax: Fix use after free and other cleanups Dan Williams
2023-06-03 6:13 ` [PATCH 1/4] dax: Fix dax_mapping_release() use after free Dan Williams
2023-06-04 2:40 ` Ira Weiny
2023-06-05 20:45 ` Fan Ni
2023-06-15 17:33 ` Dave Jiang
2023-06-03 6:13 ` [PATCH 2/4] dax: Use device_unregister() in unregister_dax_mapping() Dan Williams
2023-06-04 2:41 ` Ira Weiny
2023-06-05 20:46 ` Fan Ni
2023-06-15 17:34 ` Dave Jiang
2023-06-03 6:14 ` [PATCH 3/4] dax: Introduce alloc_dev_dax_id() Dan Williams
2023-06-04 2:57 ` Ira Weiny [this message]
2023-06-16 1:22 ` Dan Williams
2023-06-16 22:11 ` Ira Weiny
2023-06-03 6:14 ` [PATCH 4/4] dax: Cleanup extra dax_region references Dan Williams
2023-06-04 2:58 ` Ira Weiny
2023-06-06 17:46 ` Fan Ni
2023-06-06 20:42 ` Ira Weiny
2023-06-15 17:45 ` Dave Jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=647bfd7e1ef3_4c9842941c@iweiny-mobl.notmuch \
--to=ira.weiny@intel.com \
--cc=cassella@hpe.com \
--cc=dan.j.williams@intel.com \
--cc=linux-cxl@vger.kernel.org \
--cc=liuyongqiang13@huawei.com \
--cc=nvdimm@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox